josh/django-mfa2
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Removed CBOR and moved to JSON for Communication

Browse Source
This commit is contained in:
Mohamed El-Kalioby
2022-10-17 20:56:09 +03:00
parent 0ddef51eaa
commit 98b361d73d
10 changed files with 191 additions and 463 deletions
Download Patch File Download Diff File Expand all files Collapse all files

10
CHANGELOG.md
View File

@@ -1,4 +1,14 @@
# Change Log
## 3.0 (Unreleased)
* Updated to fido2==1.1.0
* Removed: CBOR and exchange is done in JSON now
* Added: the following settings
* `MFA_FIDO2_RESIDENT_KEY`: Defaults to `Discouraged` which was the old behaviour
* `MFA_FIDO2_AUTHENTICATOR_ATTACHMENT`: If you like to have a PLATFORM Authenticator, Defaults to NONE
* `MFA_FIDO2_USER_VERIFICATION`: If you need User Verification
* `MFA_FIDO2_ATTESTATION_PREFERENCE`: If you like to have an Attention
* Added: ConditionalUI support (check example)
## 2.6.1
* Fix: CVE-2022-42731: related to the possibility of registration replay attack.
Thanks to 'SSE (Secure Systems Engineering)'